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STATEMENT OF THE CASE 
This is a decision on appeal under 35 U.S.C. § 134(a) from the 

Examiner's rejection of claims 1-17. We have jurisdiction under 35 U.S.C. 

§ 6(b). 

We affirm. 

Invention 

The invention relates to providing secure access and transactions 
using a certificate authentication component to verify a user's identity, a 
directory to store an access policy for each user, and an access control 
system to restrict access to users based on the access policy information 
associated with each user (Spec. 3, 11. 4-13). 

Independent claim 1 is illustrative: 

1. An access system for a computer site, comprising a 

certificate authentication component to verify a user's identity 
from a digital certificate supplied by the user, 

a directory, coupled to the certificate authentication component, 
to maintain an account for each individual user, each account containing an 
access policy specifying at least one portion of the computer site to which 
the corresponding user is permitted access, and 

an access control system, coupled to the directory, for 
controlling access to a computer site by permitting the user to access a 
portion of the computer site and restricting the user from accessing at least 
one other portion of the computer site, based on the access policy associated 
with the individual user in a directory. 

References 

The Examiner relies upon the following references as evidence in 

support of the rejections: 

Davis US 6,367,009 Bl Apr. 2, 2002 

(filed Dec. 17, 1998) 
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Ginzboorg 



US 6,240,091 Bl 



May 29, 2001 
(filed Oct. 17, 1997) 



Bertram 
Grimmer 



US 5,948,064 
US 5,774,552 



Sep. 7, 1999 
Jun. 30, 1998 



Rejection 



The Examiner rejects claims 1, 2, and 7-14 under 35 U.S.C. § 103(a) 
as being unpatentable over Davis in view of Bertram, claims 4-6, 16, and 17 
under 35 U.S.C. § 103(a) as being unpatentable over Davis in view of 
Bertram and Ginzboorg, and claims 3 and 15 under 35 U.S.C. § 103(a) as 
being unpatentable over Davis in view of Bertram and Grimmer. 

Appellants ' Contentions 
Appellants urge reversal, arguing there is no motivation to combine 
Davis and Bertram (App. Br. 13-14). 

Examiner 's Findings/Conclusions 
The Examiner disagrees, averring that it would have been obvious to 
one of ordinary skill in the art to combine Davis and Bertram (Ans. 6). 



Have Appellants shown that the Examiner erred in concluding that it 
would have been obvious to one of ordinary skill in the art to combine Davis 
and Bertram? 



The following Findings of Fact (EE) are shown by a preponderance of 
the evidence. 



ISSUE 



FINDINGS OE EACT 
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1 . Davis teaches how to enable "the true client' s identity to be 
known to the application on the end-tier server" (Abstract). 

2. Davis teaches that "The manner in which the application 
program uses the name is application dependent, and does not form 
part of the present invention. As an example of the application- 
dependent processing, if access control is being used on the ETS as 
previously described, the application program will compare this name 
to its list (or other representation) of authorized users. If the name is 
authorized, then the application will process the request that is being 
made on behalf of the first-tier client; otherwise, the request will be 
rejected" (col. 13, 11. 33-42). 

3. Bertram teaches "a discovery 'policy' to tailor the way in which 
a user may access and interact with the discovered information" 
(Abstract). 

4. Bertram teaches that "authentication is a process is [sic] which 
the userid and password are provided to a user account database for 
validation. Upon successful validation, a positive confirmation is 
received for the authentication and the user processing is allowed to 
continue" (col. 6, 11. 1-5). 

PRINCIPLES OF LAW 

Obviousness 

Section 103(a) forbids issuance of a patent when "the 
differences between the subject matter sought to be patented 
and the prior art are such that the subject matter as a whole 
would have been obvious at the time the invention was made to 
a person having ordinary skill in the art to which said subject 
matter pertains." 
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KSR Int'l Co. V. Teleflex Inc., 550 U.S. 398, 406 (2007). 

"What matters is the objective reach of the claim. If the claim extends 
to what is obvious, it is invalid under § 103." Id. at 419. In KSR, the 
Supreme Court emphasized "the need for caution in granting a patent based 
on the combination of elements found in the prior art," id. at 415, and 
discussed circumstances in which a patent might be determined to be 
obvious. Id. at 415-16 (citing Graham v. John Deere Co., 383 U.S. 1, 12 
(1966)). The Court reaffirmed principles based on its precedent that "[t]he 
combination of familiar elements according to known methods is likely to be 
obvious when it does no more than yield predictable results." Id. at 416. 
The operative question in this "functional approach" is thus "whether the 
improvement is more than the predictable use of prior art elements according 
to their established functions." Id. at 415, 417. 

The Federal Circuit recognizes that "[a]n obviousness determination is 
not the result of a rigid formula disassociated from the consideration of the 
facts of a case. Indeed, the common sense of those skilled in the art 
demonstrates why some combinations would have been obvious where 
others would not." Leapfrog Enters., Inc. v. Fisher-Price, Inc., 485 F.3d 
1157, 1161 (Fed. Cir. 2007) (citing KSR, 127 S. Ct. 1727, 1739 (2007)). 
The Federal Circuit relied in part on the fact that Leapfrog had presented no 
evidence that the inclusion of a reader in the combined device was "uniquely 
challenging or difficult for one of ordinary skill in the art" or "represented an 
unobvious step over the prior art." Id. at 1162 (citing KSR, 127 S. Ct. at 
1740-41). 
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ANALYSIS 

We concur with the Examiner' s finding that it would have been 
obvious to one of ordinary skill in the art to combine Davis and Bertram. 
Davis teaches how to identify who or what is trying to connect to a protected 
system (FF 1). Bertram teaches the use of user accounts to establish access 
control policies for protected systems (FF 3-4). These are complementary 
teachings, both being used according to their established functions to yield a 
predictable result. See KSR, 550 U.S. at 417. 

Appellants have not shown that it would have been uniquely 
challenging or difficult for one of ordinary skill in the art to combine Davis 
and Bertram. See Leapfrog Enters., Inc., 485 F.3d at 1 162. Nor have 
Appellants shown that the invention represents an unobvious step over Davis 
and Bertram. Id. 

Furthermore, the Examiner recognized that one of ordinary skill in the 
art would have been motivated to look to what was known outside of Davis 
to improve its "security and flexibility" (Ans. 4). Davis presented a simple 
access control policy example: a list of authorized users. But Davis made 
clear that access control policies were not part of the invention (FF 2). One 
of ordinary skill in the art would look to other authentication teachings, such 
as Bertram (FF 4), to find access control policy teachings more robust than 
the example described in Davis. 

For at least these reasons, we conclude that Appellants have not 
sustained the requisite burden on appeal in providing arguments or evidence 
persuasive of error in the Examiner's rejection of claims 1, 2, and 7-14. 
Appellants make no new arguments in support of claims 3-6 and 15-17, 
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thus we further conclude that Appellants have not shown error in the 
Examiner's rejection of these claims. 

CONCLUSIONS OF LAW 
Based on the findings of facts and analysis above, we conclude that 
Appellants have failed to demonstrate that the Examiner erred in finding that 
it would have been obvious to one of ordinary skill in the art to combine 
Davis and Bertram. 

DECISION 

We affirm the Examiner's decision rejecting claims 1-17. 
AFFIRMED 
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